Reexamination of an all-in-one voting machine

The co-chair of the New York State Board of Elections has formally requested that the Election Operations Unit of the State Board re-examine the State’s certification of the Dominion ImageCast Evolution voting machine.

The Dominion ImageCast Evolution (also called Dominion ICE) is an “all-in-one” voting machine that combines in the same paper path an optical scanner (for hand-marked bubble ballots) with a printer (for machine-marked ballots via a touchscreen or audio interface).

Last October, I explained that why this is such a bad idea that it should be considered a design flaw:  if a hacker were able to install fraudulent software into the ICE, that software could print additional votes onto a voter’s ballot after the last time the voter sees the ballot.   I’ll just give one example of what the hacker’s vote-stealing software could do:  In any race where the voter undervotes (does not mark a choice), the hacked software could print a vote into the bubble for the candidate that the hacker wants to win.

The manufacturer may argue that “our software doesn’t do that;” true enough, the factory-installed software doesn’t do that–unless hackers hack into the manufacturer’s network.  They may argue that “our voting machines are not hackable;” well, it’s admirable that they are using modern-day authentication methods for the installation of new software, but in the current state of the art, it’s still the case that practically any computer is hackable.

And therefore, we rely on recounts and risk-limiting audits of the paper ballot as marked by the voter as our ultimate protection against computer hacking.  An all-in-one voting machine, that combines printing and scanning into the same paper path, seriously compromises that protection.

Douglas A. Kellner, co-chair of the New York State Board of elections, wrote on March 7 2019 to his fellow Board commissioners,

Two respected professors of computer science have provided reports that the Dominion ImageCast Evolution voting machine has a “design flaw.” … “after you mark your ballot, after you review your ballot, the voting machine can print more votes on it!” …

[New York State] Election Law § 7-201 requires that the State Board of Elections examine and approve each type of voting machine or voting system before it can be used in New York State…. The examination criteria for certification of voting equipment … requires … “the vendor shall identify each potential point of attack.” …

I have carefully reviewed Dominion’s [submission].  I do not see anything in the submission that addressed the point of attack or threats identified by Professors Appel and DeMillo. …

If there is a serious possibility that an insider could install malware that could program the printer to add marks to a ballot without the possibility of verification by the voter, then the entire audit process is compromised and circumvented. If it was possible for the machine to add a voting mark to the ballot without verification by the voter, the audit is not meaningful because it cannot confirm that the ballot was counted in the manner intended by the voter. …

Election Law § 7-201(3) provides that:  “If at any time after any machine or system has been approved,…the state board of elections has any reason to believe that such machine or system does not meet all the requirements for voting machines or systems set forth in this article, it shall forthwith cause such machine or system to be examined again.” …

In view of the omission of the security threats identified by Professors Appel and DeMillo in the submission by Dominion in support of its application for certification of the ImageCast Evolution, and in view of the absence of any analysis of this issue in the SLI and NYSTEC reports, I request that the Election Operations Unit of the State Board examine again the ImageCast Evolution to consider the vulnerability of the voting system because the printer could be programmed to add marks to ballots without verification by the voter, and that SLI and NYSTEC supplement their reports with respect to these issues.